> ## Documentation Index
> Fetch the complete documentation index at: https://enterprise-docs.crewai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# BuildKit Configuration

> Configuration for the BuildKit service used for crew container builds.

<ParamField path="buildkit.enabled" type="boolean" default="true">
  Enable or disable BuildKit deployment.

  **Required For:** `PROVIDER: BUILDKIT_KUBERNETES` crew deployment mode.

  **When Disabled:** Crew container builds will fail unless using an alternative provider.
</ParamField>

<ParamField path="buildkit.replicaCount" type="integer" default="1">
  Number of BuildKit daemon replicas.

  **Recommendation:** Single replica is sufficient for most deployments. Increase for high-concurrency build environments.
</ParamField>

### `buildkit.image.*`

BuildKit container image configuration.

<ParamField path="buildkit.image.host" type="string" default="">
  Container registry hosting the BuildKit image.

  **Default:** `""` (empty) - Automatically uses `global.imageRegistry` value

  **Fallback Behavior:**

  When `buildkit.image.host` is empty or not set, the chart uses `global.imageRegistry` via the `crewai-platform.buildkitImageRegistry` template helper.

  **Automatic Image Override:**

  When `buildkit.enabled: true`, the chart automatically sets the `BUILDKIT_IMAGE_OVERRIDE` environment variable by combining these values:

  ```
  BUILDKIT_IMAGE_OVERRIDE = <registry>/<name>:<tag>
  ```

  Where `<registry>` is determined by: `buildkit.image.host` OR `global.imageRegistry` (fallback)

  This allows the application to reference the same BuildKit image used by the BuildKit service, ensuring version consistency.

  **When imageNamePrefixOverride is Set:**

  The image name is automatically simplified:

  * Original: `proxy/crewai/crewai/crewai/buildkit`
  * With `imageNamePrefixOverride: "crewai/"` becomes: `crewai/buildkit`

  See [global.imageNamePrefixOverride](/reference/chart-values/global#param-global-image-name-prefix-override) for details.
</ParamField>

<ParamField path="buildkit.image.name" type="string" default="proxy/crewai/crewai/crewai/buildkit">
  BuildKit container image name.

  **Default:** `"proxy/crewai/crewai/crewai/buildkit"` - Matches Replicated proxy path structure

  **Path Transformation:**

  When `global.imageNamePrefixOverride` is set, only the final component (`buildkit`) is used with the override prefix.
</ParamField>

<ParamField path="buildkit.image.tag" type="string" default="v2026.0408.105">
  BuildKit image version tag.

  **Version Consistency:** This tag must match the BuildKit version expected by the CrewAI Platform.
</ParamField>

<ParamField path="buildkit.image.pullPolicy" type="string" default="IfNotPresent">
  Image pull policy for BuildKit container.

  **Valid Values:**

  * `"IfNotPresent"` - Pull only if not cached locally (recommended)
  * `"Always"` - Always pull latest version
  * `"Never"` - Never pull, use local cache only
</ParamField>

<ParamField path="buildkit.image.pullSecret" type="string" default="">
  Image pull secret for BuildKit image. If empty, defaults to `image.pullSecret`.
</ParamField>

### `buildkit.rootless.*`

Rootless mode configuration for BuildKit. When enabled, BuildKit runs without requiring a privileged container, improving security by running as a non-root user with user namespace remapping.

<ParamField path="buildkit.rootless.enabled" type="boolean" default="false">
  Enable rootless BuildKit mode.

  **Security Benefits:**

  * No privileged container required
  * Runs as non-root user (UID 1000 by default)
  * User namespace remapping for enhanced isolation

  **Requirements:**

  * Kubernetes nodes must allow `seccompProfile: Unconfined` and `appArmorProfile: Unconfined`
  * Some Kubernetes platforms (e.g., GKE Autopilot) may not support rootless mode

  **When Enabled:**

  * Uses dedicated rootless BuildKit image
  * Automatically configures security contexts and volume mounts
  * Overrides `buildkit.userns` settings (deprecated)
</ParamField>

<ParamField path="buildkit.rootless.image.name" type="string" default="proxy/crewai/crewai/crewai/buildkit-rootless">
  BuildKit rootless container image name.

  **Path Transformation:**

  When `global.imageNamePrefixOverride` is set, only the final component (`buildkit-rootless`) is used with the override prefix.
</ParamField>

<ParamField path="buildkit.rootless.image.tag" type="string" default="v2026.0408.105">
  BuildKit rootless image version tag.
</ParamField>

<ParamField path="buildkit.rootless.runAsUser" type="integer" default="1000">
  User ID to run rootless BuildKit process.

  **Default:** `1000` (standard non-root user)

  **Note:** This value is used for both pod and container security contexts.
</ParamField>

<ParamField path="buildkit.rootless.runAsGroup" type="integer" default="1000">
  Group ID to run rootless BuildKit process.

  **Default:** `1000`
</ParamField>

<ParamField path="buildkit.rootless.fsGroup" type="integer" default="1000">
  Filesystem group ID for volume ownership.

  **Default:** `1000`

  **Purpose:** Ensures proper volume permissions for rootless user.
</ParamField>

### `buildkit.service.*`

BuildKit service configuration.

<ParamField path="buildkit.service.type" type="string" default="ClusterIP">
  Service type for BuildKit.

  **Valid Values:**

  * `"ClusterIP"` - Internal cluster access (recommended)
  * `"NodePort"` - Expose on node ports (development/testing)
</ParamField>

<ParamField path="buildkit.service.port" type="integer" default="1234">
  Service port for BuildKit API.
</ParamField>

<ParamField path="buildkit.service.nodePort" type="integer" default="30000">
  NodePort when `type: NodePort`.
</ParamField>

### `buildkit.userns.*` (Deprecated)

<Warning>
  This configuration is deprecated in favor of `buildkit.rootless` mode. Use `buildkit.rootless.enabled: true` for improved security with rootless BuildKit.
</Warning>

Legacy user namespace configuration for enhanced container isolation.

<ParamField path="buildkit.userns.enabled" type="boolean" default="false">
  Enable legacy user namespace remapping mode.

  **Deprecation Notice:** Use `buildkit.rootless.enabled: true` instead for enhanced security without privileged containers.

  **Security Benefit:** Provides additional isolation by mapping container root user to unprivileged host user (when not using rootless mode).

  **Note:** This setting is ignored when `buildkit.rootless.enabled: true`.
</ParamField>

<ParamField path="buildkit.runAsUser" type="integer">
  User ID to run BuildKit process (legacy mode only).

  **Use With:** `userns.enabled: true` (when `rootless.enabled: false`)

  **For Rootless Mode:** Use `buildkit.rootless.runAsUser` instead

  **Default:** Undefined (runs as default user)
</ParamField>

<ParamField path="buildkit.runAsGroup" type="integer">
  Group ID to run BuildKit process (legacy mode only).

  **Use With:** `userns.enabled: true` (when `rootless.enabled: false`)

  **For Rootless Mode:** Use `buildkit.rootless.runAsGroup` instead

  **Default:** Undefined
</ParamField>

<ParamField path="buildkit.oci.enabled" type="boolean" default="true">
  Enable OCI worker for BuildKit.

  **Purpose:** Provides OCI-compliant container runtime for builds.
</ParamField>

<ParamField path="buildkit.containerd.enabled" type="boolean" default="false">
  Enable containerd worker for BuildKit.

  **Purpose:** Alternative runtime to OCI worker. Generally not needed.
</ParamField>

<ParamField path="buildkit.debug" type="boolean" default="false">
  Enable debug logging for BuildKit.

  **Use Cases:**

  * Troubleshooting build failures
  * Debugging registry authentication issues
  * Performance analysis
</ParamField>

<ParamField path="buildkit.dockerConfigSecret" type="string" default="docker-registry">
  Name of Kubernetes secret containing Docker config.json for registry authentication.

  **Format:** The secret should contain a `.dockerconfigjson` key with base64-encoded Docker config.

  **Example:**

  ```bash theme={null}
  kubectl create secret docker-registry buildkit-registry-creds \
    --docker-server=registry.company.com \
    --docker-username=user \
    --docker-password=pass
  ```

  ```yaml theme={null}
  buildkit:
    dockerConfigSecret: "buildkit-registry-creds"
  ```
</ParamField>

<ParamField path="buildkit.registries" type="array" default="[]">
  Registry mirror and insecure registry configuration.

  **Schema:**

  ```yaml theme={null}
  buildkit:
    registries:
      - hostname: "registry.company.com"
        http: false
        insecure: false
        mirrors:
          - "mirror1.company.com"
          - "mirror2.company.com"
      - hostname: "localhost:30000"
        http: true
        insecure: true
  ```

  **Fields:**

  * `hostname`: Registry hostname
  * `http`: Use HTTP instead of HTTPS
  * `insecure`: Skip TLS verification
  * `mirrors`: Mirror registries for pull-through

  **Use Cases:**

  * Configure insecure internal registries
  * Set up registry mirrors for faster pulls
  * Configure air-gapped registry access
</ParamField>

### `buildkit.healthcheck.*`

Health check configuration for BuildKit pods.

<ParamField path="buildkit.healthcheck.enabled" type="boolean" default="true">
  Enable liveness and readiness probes for BuildKit.
</ParamField>

<ParamField path="buildkit.healthcheck.initialDelaySeconds" type="integer" default="30">
  Seconds to wait before first health check probe.

  **Tuning:** Increase if BuildKit takes longer to initialize.
</ParamField>

<ParamField path="buildkit.healthcheck.periodSeconds" type="integer" default="10">
  Seconds between health check probes.
</ParamField>

<ParamField path="buildkit.healthcheck.timeoutSeconds" type="integer" default="5">
  Health check probe timeout in seconds.
</ParamField>

<ParamField path="buildkit.healthcheck.successThreshold" type="integer" default="1">
  Consecutive successful probes required to mark pod healthy.
</ParamField>

<ParamField path="buildkit.healthcheck.failureThreshold" type="integer" default="3">
  Consecutive failed probes before restarting pod.
</ParamField>

### `buildkit.resources.*`

Resource limits and requests for BuildKit container.

<ParamField path="buildkit.resources.limits.cpu" type="string" default="4">
  CPU limit for BuildKit pod.

  **Performance Impact:** CPU limits directly affect build performance. Higher limits = faster builds.

  **Sizing Guidelines:**

  * Standard builds: `"4"`
  * High-concurrency: `"8"` or higher
</ParamField>

<ParamField path="buildkit.resources.limits.memory" type="string" default="8Gi">
  Memory limit for BuildKit pod.

  **Sizing Guidelines:**

  * Standard builds: `"8Gi"`
  * Large/complex builds: `"16Gi"` or higher
</ParamField>

<ParamField path="buildkit.resources.requests.cpu" type="string" default="250m">
  Guaranteed CPU allocation for BuildKit pod.

  **Tuning:** Start conservative, BuildKit scales based on build activity.
</ParamField>

<ParamField path="buildkit.resources.requests.memory" type="string" default="1Gi">
  Guaranteed memory allocation for BuildKit pod.
</ParamField>

<ParamField path="buildkit.nodeSelector" type="object" default="{}">
  Node selector for BuildKit pod placement.

  **Example:**

  ```yaml theme={null}
  buildkit:
    nodeSelector:
      node-role.kubernetes.io/worker: "true"
      workload-type: "build"
  ```
</ParamField>

***